aad35825122d240d24e097e1b1701eb3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aad35825122d240d24e097e1b1701eb3
Size

334KB
MD5

aad35825122d240d24e097e1b1701eb3
SHA1

c2c9402afcdda1c8dd7d1dd93536d0aed211be62
SHA256

cf45999589ae9ef71b96404eb38272f5e351d3d2678ee886d413deb16999045d
SHA512

46c97325539d732d2dc0a81b043508e289d9e95ae5ade77d1927a4f26415be54af9175446070121989d9cc6406164a8b4b42c110c0e8558d0c734e8dea4cd1a9
SSDEEP

6144:nvcc+F2xgw45Q55diDae2V01NDA/VZU8b+njf1ckYrQHIHpKJjMq7zv6qavu:vyMxg7059y12/VZPb+71cSIqPvLaW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aad35825122d240d24e097e1b1701eb3

Files

aad35825122d240d24e097e1b1701eb3
.exe windows:4 windows x86 arch:x86

c42bf4107481f4960a34f220d5944482

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

shell32

ShellExecuteA

Sections

CODE
Size: 85KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE